ASP.NET Security Roles AND Permissions

Question

I\'m comfortable with the ASP.NET security model whereby one can allow/deny access to users in the web.config based on what roles they are in e.g.

Answer 1

It's not there out of the box; but if you wanted to be more granular, why not have granular roles like "CanPrint", "CanDelete" rather than wider ones like "Admin"?

If they want a container type scenario as you indicate in your comments you could setup a custom IPrincipal - where, after authentication, and with each new request you look at the user's role membership ("Admin", "Public" etc.) and then override IsInRole on your IPrincipal. You can find an example here